The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
References
| Link | Resource |
|---|---|
| https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php | Patch Third Party Advisory |
| https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053 | Exploit Third Party Advisory |
Configurations
History
23 Aug 2022, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wpmanageninja:ninja_job_board:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053 - Exploit, Third Party Advisory | |
| References | (CONFIRM) https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php - Patch, Third Party Advisory |
22 Aug 2022, 16:35
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-22 15:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-2544
Mitre link : CVE-2022-2544
CVE.ORG link : CVE-2022-2544
JSON object : View
Products Affected
wpmanageninja
- ninja_job_board
CWE
CWE-425
Direct Request ('Forced Browsing')